#include <vnet/ipsec/ipsec.h>
#include <vnet/ipsec/esp.h>
+#include <vnet/ipsec/ipsec_io.h>
/* Statistics (not really errors) */
#define foreach_ipsec_if_input_error \
_(RX, "good packets received") \
-_(DISABLED, "ipsec packets received on disabled interface")
+_(DISABLED, "ipsec packets received on disabled interface") \
+_(NO_TUNNEL, "no matching tunnel")
static char *ipsec_if_input_error_strings[] = {
#define _(sym,string) string,
u32 seq;
} ipsec_if_input_trace_t;
-u8 *
+static u8 *
format_ipsec_if_input_trace (u8 * s, va_list * args)
{
CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
return s;
}
-static uword
-ipsec_if_input_node_fn (vlib_main_t * vm, vlib_node_runtime_t * node,
- vlib_frame_t * from_frame)
+VLIB_NODE_FN (ipsec_if_input_node) (vlib_main_t * vm,
+ vlib_node_runtime_t * node,
+ vlib_frame_t * from_frame)
{
ipsec_main_t *im = &ipsec_main;
vnet_main_t *vnm = im->vnet_main;
ipsec_proto_main_t *em = &ipsec_proto_main;
u32 *from, *to_next = 0, next_index;
u32 n_left_from, last_sw_if_index = ~0;
- u32 thread_index = vlib_get_thread_index ();
+ u32 thread_index = vm->thread_index;
u64 n_bytes = 0, n_packets = 0;
u8 icv_len;
ipsec_tunnel_if_t *last_t = NULL;
ipsec_sa_t *sa0;
vlib_combined_counter_main_t *rx_counter;
vlib_combined_counter_main_t *drop_counter;
- u32 n_disabled = 0;
+ u32 n_disabled = 0, n_no_tunnel = 0;
rx_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_RX;
drop_counter = vim->combined_sw_if_counters + VNET_INTERFACE_COUNTER_DROP;
next0 = IPSEC_INPUT_NEXT_DROP;
- u64 key = (u64) ip0->src_address.as_u32 << 32 |
- (u64) clib_net_to_host_u32 (esp0->spi);
+ u64 key = (u64) ip0->src_address.as_u32 << 32 | (u64) esp0->spi;
p = hash_get (im->ipsec_if_pool_index_by_key, key);
}
vlib_buffer_advance (b0, ip4_header_bytes (ip0));
- next0 = im->esp_decrypt_next_index;
+ next0 = im->esp4_decrypt_next_index;
+ }
+ else
+ {
+ b0->error = node->errors[IPSEC_IF_INPUT_ERROR_NO_TUNNEL];
+ n_no_tunnel++;
}
trace:
vlib_node_increment_counter (vm, ipsec_if_input_node.index,
IPSEC_IF_INPUT_ERROR_DISABLED, n_disabled);
+ vlib_node_increment_counter (vm, ipsec_if_input_node.index,
+ IPSEC_IF_INPUT_ERROR_DISABLED, n_no_tunnel);
return from_frame->n_vectors;
}
/* *INDENT-OFF* */
VLIB_REGISTER_NODE (ipsec_if_input_node) = {
- .function = ipsec_if_input_node_fn,
.name = "ipsec-if-input",
.vector_size = sizeof (u32),
.format_trace = format_ipsec_if_input_trace,
.n_errors = ARRAY_LEN(ipsec_if_input_error_strings),
.error_strings = ipsec_if_input_error_strings,
- .sibling_of = "ipsec-input-ip4",
+ .sibling_of = "ipsec4-input-feature",
};
/* *INDENT-ON* */
-VLIB_NODE_FUNCTION_MULTIARCH (ipsec_if_input_node, ipsec_if_input_node_fn)
/*
* fd.io coding-style-patch-verification: ON
*